@ironfang/n8n-nodes-ironfang 0.4.2 → 0.4.3

package/README.md

@@ -6,7 +6,7 @@ Use Ironfang Render, Finance, Audit and Rig, and Ironfang's public developer
 tools, in n8n. The Ironfang action node has **162 operations**, grouped by
 product. Ironfang Trigger receives signed Audit, Finance and Render events.
 
-**Release: 0.4.2.** The API is now at `api.ironfang.com`; credentials saved with the old `api.ironfang.uk` address keep working unchanged. 0.4.1 made the package installable on n8n releases
+**Release: 0.4.3.** Credits, cache status and webhook signatures are read from the `X-Ironfang-*` and `Ironfang-*` headers; update before the API stops sending the launch-era ones. 0.4.2 moved the API to `api.ironfang.com` (credentials saved with the old `api.ironfang.uk` address keep working unchanged), and 0.4.1 made the package installable on n8n releases
 before 2.33 that use PostgreSQL; see [Installation](#installation-and-credentials).
 It includes 0.4.0, in which the products are named Ironfang Render, Finance and Audit
 (formerly Renderwolf, Financewolf and Auditwolf), and the node follows: requests
@@ -164,8 +164,9 @@ The trigger verifies HMAC-SHA256 over the timestamp and exact body bytes using
 constant-time comparison, accepts timestamps within five minutes, and rejects
 invalid signatures before starting a workflow. Render and Finance secrets are
 decoded from hex; Audit secrets are used as returned. Deliveries are signed in
-the `Renderwolf-`, `Financewolf-` and `Auditwolf-` headers the products launched
-with; the trigger reads the ones for the credential's product. The signed event ID, rather
+the `Ironfang-Signature` and `Ironfang-Timestamp` headers; the trigger still
+reads the `Renderwolf-`, `Financewolf-` or `Auditwolf-` headers the products
+launched with when those are all a delivery carries. The signed event ID, rather
 than the unsigned header ID, is used for duplicate detection.
 
 Duplicate state covers seven days/up to 10,000 IDs in n8n workflow static data.

package/dist/nodes/Ironfang/transport.js

@@ -36,9 +36,9 @@ function responseMetadata(headers, statusCode) {
     const result = { statusCode };
     if (headers['x-ironfang-request-id'])
         result.requestId = headers['x-ironfang-request-id'];
-    if (headers['x-renderwolf-cache'])
-        result.cacheStatus = headers['x-renderwolf-cache'];
-    const credits = headers['x-renderwolf-credits'];
+    if (headers['x-ironfang-cache'])
+        result.cacheStatus = headers['x-ironfang-cache'];
+    const credits = headers['x-ironfang-credits'];
     if (credits !== undefined && credits !== '' && Number.isFinite(Number(credits)))
         result.creditsCharged = Number(credits);
     return result;

package/dist/nodes/Ironfang/webhook.js

@@ -4,8 +4,10 @@ exports.signingKey = signingKey;
 exports.verifyEvent = verifyEvent;
 exports.webhookCredentialTest = webhookCredentialTest;
 const crypto_1 = require("crypto");
-// Signature headers keep the launch names (Renderwolf-Signature and so on), which
-// are also the saved product values. Render and Finance issue hex secrets.
+// Every product signs with Ironfang-Signature and Ironfang-Timestamp. The saved
+// product values keep the launch names (renderwolf and so on), and deliveries
+// from before the Ironfang-* headers carried only <Launch name>-Signature, which
+// is still read when the new header is absent. Render and Finance issue hex secrets.
 function signingKey(product, secret) {
     if (['renderwolf', 'financewolf'].includes(product) && /^[a-f0-9]{64}$/i.test(secret))
         return Buffer.from(secret, 'hex');
@@ -16,8 +18,8 @@ function signingKey(product, secret) {
 function verifyEvent(raw, headers, product, secret, now) {
     if (!raw.length || raw.length > 65_536)
         throw new Error('Webhook payload size is invalid');
-    const timestamp = headers[`${product}-timestamp`];
-    const signature = headers[`${product}-signature`];
+    const timestamp = headers['ironfang-timestamp'] ?? headers[`${product}-timestamp`];
+    const signature = headers['ironfang-signature'] ?? headers[`${product}-signature`];
     if (typeof timestamp !== 'string' || !/^\d{10,11}$/.test(timestamp) || Math.abs(now / 1000 - Number(timestamp)) > 300)
         throw new Error('Webhook timestamp is invalid or expired');
     if (typeof signature !== 'string' || !/^v1=[a-f0-9]{64}$/.test(signature))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ironfang/n8n-nodes-ironfang",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "n8n nodes for Ironfang: Render, Finance, Audit, Rig, public tools and signed events",
   "keywords": [
     "n8n-community-node-package",